diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 9877f8b..304820f 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -45,6 +45,9 @@ jobs:
       - name: Checkout repository
         uses: actions/checkout@v4
 
+      - name: Lowercase image name
+        run: echo "IMAGE_NAME=ghcr.io/$(echo "${{ github.repository }}" | tr '[:upper:]' '[:lower:]')" >> "$GITHUB_ENV"
+
       - name: Set up QEMU
         uses: docker/setup-qemu-action@v3
 
@@ -55,7 +58,7 @@ jobs:
         id: meta
         uses: docker/metadata-action@v5
         with:
-          images: ghcr.io/${{ github.repository }}
+          images: ${{ env.IMAGE_NAME }}
           flavor: |
             latest=auto
           tags: |
diff --git a/Dockerfile b/Dockerfile
index 34c8a78..2975cb8 100644
--- a/Dockerfile
+++ b/Dockerfile
@@ -15,14 +15,13 @@ WORKDIR /app
 ENV NODE_ENV=production
 
 # Copy installed production node_modules from builder
-COPY --from=builder /app/node_modules ./node_modules
+COPY --chown=bun:bun --from=builder /app/node_modules ./node_modules
 
 # Copy application configuration and source code
-COPY package.json tsconfig.json ./
-COPY src ./src
+COPY --chown=bun:bun package.json tsconfig.json ./
+COPY --chown=bun:bun src ./src
 
-# Set ownership and drop root privileges
-RUN chown -R bun:bun /app
+# Drop root privileges
 USER bun
 
 # Standard MCP stdio communication
diff --git a/tests/ci-workflow.test.ts b/tests/ci-workflow.test.ts
index 7fb3892..1b87383 100644
--- a/tests/ci-workflow.test.ts
+++ b/tests/ci-workflow.test.ts
@@ -44,7 +44,8 @@ describe("GitHub Actions CI Workflow", () => {
     expect(content).toContain("docker/setup-qemu-action@v3");
     expect(content).toContain("docker/setup-buildx-action@v3");
     expect(content).toContain("docker/metadata-action@v5");
-    expect(content).toContain("ghcr.io/${{ github.repository }}");
+    expect(content).toContain("IMAGE_NAME=ghcr.io/$(echo \"${{ github.repository }}\" | tr '[:upper:]' '[:lower:]')");
+    expect(content).toContain("images: ${{ env.IMAGE_NAME }}");
     expect(content).toContain("docker/login-action@v3");
     expect(content).toContain("registry: ghcr.io");
     expect(content).toContain("docker/build-push-action@v6");